Go to file
Thomas Zimmermann 02650b3b98 drm/atomic-helpers: Invoke end_fb_access while owning plane state
commit e0f04e41e8 upstream.

Invoke drm_plane_helper_funcs.end_fb_access before
drm_atomic_helper_commit_hw_done(). The latter function hands over
ownership of the plane state to the following commit, which might
free it. Releasing resources in end_fb_access then operates on undefined
state. This bug has been observed with non-blocking commits when they
are being queued up quickly.

Here is an example stack trace from the bug report. The plane state has
been free'd already, so the pages for drm_gem_fb_vunmap() are gone.

Unable to handle kernel paging request at virtual address 0000000100000049
[...]
 drm_gem_fb_vunmap+0x18/0x74
 drm_gem_end_shadow_fb_access+0x1c/0x2c
 drm_atomic_helper_cleanup_planes+0x58/0xd8
 drm_atomic_helper_commit_tail+0x90/0xa0
 commit_tail+0x15c/0x188
 commit_work+0x14/0x20

Fix this by running end_fb_access immediately after updating all planes
in drm_atomic_helper_commit_planes(). The existing clean-up helper
drm_atomic_helper_cleanup_planes() now only handles cleanup_fb.

For aborted commits, roll back from drm_atomic_helper_prepare_planes()
in the new helper drm_atomic_helper_unprepare_planes(). This case is
different from regular cleanup, as we have to release the new state;
regular cleanup releases the old state. The new helper also invokes
cleanup_fb for all planes.

The changes mostly involve DRM's atomic helpers. Only two drivers, i915
and nouveau, implement their own commit function. Update them to invoke
drm_atomic_helper_unprepare_planes(). Drivers with custom commit_tail
function do not require changes.

v4:
	* fix documentation (kernel test robot)
v3:
	* add drm_atomic_helper_unprepare_planes() for rolling back
	* use correct state for end_fb_access
v2:
	* fix test in drm_atomic_helper_cleanup_planes()

Reported-by: Alyssa Ross <hi@alyssa.is>
Closes: https://lore.kernel.org/dri-devel/87leazm0ya.fsf@alyssa.is/
Suggested-by: Daniel Vetter <daniel@ffwll.ch>
Fixes: 94d879eaf7 ("drm/atomic-helper: Add {begin,end}_fb_access to plane helpers")
Tested-by: Alyssa Ross <hi@alyssa.is>
Reviewed-by: Alyssa Ross <hi@alyssa.is>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Cc: <stable@vger.kernel.org> # v6.2+
Link: https://patchwork.freedesktop.org/patch/msgid/20231204083247.22006-1-tzimmermann@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-12-13 18:45:25 +01:00
arch kernel/Kconfig.kexec: drop select of KEXEC for CRASH_DUMP 2023-12-13 18:45:19 +01:00
block block: update the stable_writes flag in bdev_add 2023-12-03 07:33:03 +01:00
certs
crypto crypto: pcrypt - Fix hungtask for PADATA_RESET 2023-11-28 17:19:42 +00:00
Documentation tee: optee: Fix supplicant based device enumeration 2023-12-13 18:45:11 +01:00
drivers drm/atomic-helpers: Invoke end_fb_access while owning plane state 2023-12-13 18:45:25 +01:00
fs nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage() 2023-12-13 18:45:22 +01:00
include drm/atomic-helpers: Invoke end_fb_access while owning plane state 2023-12-13 18:45:25 +01:00
init proc: sysctl: prevent aliased sysctls from getting passed to init 2023-11-28 17:19:57 +00:00
io_uring io_uring: fix mutex_unlock with unreferenced ctx 2023-12-13 18:45:20 +01:00
ipc
kernel workqueue: Make sure that wq_unbound_cpumask is never empty 2023-12-13 18:45:24 +01:00
lib lib/group_cpus.c: avoid acquiring cpu hotplug lock in group_cpus_evenly 2023-12-13 18:45:22 +01:00
LICENSES
mm mm/memory_hotplug: fix error handling in add_memory_resource() 2023-12-13 18:45:25 +01:00
net packet: Move reference count in packet_sock to atomic_long_t 2023-12-13 18:45:23 +01:00
rust rust: docs: fix logo replacement 2023-10-19 16:40:00 +02:00
samples samples/bpf: syscall_tp_user: Fix array out-of-bound access 2023-11-28 17:19:48 +00:00
scripts checkstack: fix printed address 2023-12-13 18:45:22 +01:00
security apparmor: Fix regression in mount mediation 2023-11-28 17:20:07 +00:00
sound ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 2023-12-13 18:45:21 +01:00
tools selftests/net: mptcp: fix uninitialized variable warnings 2023-12-08 08:52:22 +01:00
usr
virt ARM: 2023-09-07 13:52:20 -07:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap 20 hotfixes. 12 are cc:stable and the remainder address post-6.5 issues 2023-10-24 09:52:16 -10:00
.rustfmt.toml
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS Char/Misc driver fixes for 6.6-final 2023-10-28 07:51:27 -10:00
Makefile Linux 6.6.6 2023-12-11 10:40:17 +01:00
README

Linux kernel

There are several guides for kernel developers and users. These guides can be rendered in a number of formats, like HTML and PDF. Please read Documentation/admin-guide/README.rst first.

In order to build the documentation, use make htmldocs or make pdfdocs. The formatted documentation can also be read online at:

https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory, several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the requirements for building and running the kernel, and information about the problems which may result by upgrading your kernel.